@sebastienrousseau/dotfiles 0.2.518 → 0.2.520

package/CHANGELOG.md

@@ -2,6 +2,195 @@
 
 This file documents all notable changes to this project.
 
+## Unreleased
+
+## v0.2.520 — 2026-09-13
+
+### Added
+
+- `docs/guides/MACOS_ICLOUD_SYMLINKS.md`, documenting what the hook does, the
+  cases it refuses, and how to resolve each one by hand.
+- A safety regression suite and a unit suite for the hook, covering the refusal
+  paths that the destructive version never had.
+- Performance budgets for the shell startup path, with the budget table and its
+  rationale in `docs/operations/PERFORMANCE_BUDGETS.md`.
+- A gate-integrity regression test asserting that the safety checks cannot be
+  disabled without a test failing.
+- `dot mcp serve` — a real stdio Model Context Protocol server, where the
+  published card had previously described one that did not exist. Full
+  lifecycle with version negotiation across three protocol revisions,
+  `tools/list`, `tools/call`, resources and logging, with proper JSON-RPC
+  error objects. All four tools are read-only and run from closed argument
+  vectors without a shell; the mutating operations are deliberately
+  unreachable. Go, standard library only.
+- A feature matrix covering every routable command, flag, environment
+  variable and config key, each row naming the regression test, benchmark,
+  example and manual section that covers it. The gate fails when a command
+  gains no row, or when a row names a test or example that does not exist,
+  so coverage cannot be claimed in the table without being written.
+- `dot attest --verify` (`--json|-j`, `--max-age|-a`): checks a workstation
+  evidence record against the attestation policy by running `lib/wasm-tools`
+  as WebAssembly under `wasmtime`. The module gets stdin, stdout and a clock
+  and nothing else — no filesystem, no network, no environment — so the
+  verdict does not depend on the tools installed on the machine under review.
+  Eleven checks cover evidence freshness, the required identity fields, the
+  git signing configuration, the agent profile and MCP health.
+- `scripts/diagnostics/attest-verify.sh`, the caller behind that flag: it
+  resolves the module and the runtime, builds the module on demand when a
+  Rust toolchain is present, and forwards an evidence file, a pipe, or a
+  fresh `dot attest --json`.
+- `dot-sys` gained a real `wasm32-wasip1` target, a general JSON reader
+  (`dot_sys::json`), an RFC 3339 UTC parser (`dot_sys::time`), the policy
+  itself (`dot_sys::attest`), a `verify` subcommand, `--help` and
+  `--version`, two more fuzz targets (`fuzz_json`, `fuzz_verify`), a fourth
+  example, a second benchmark suite, and `tests/wasm.rs`, which executes the
+  built module in a runtime rather than merely inspecting the artefact.
+- `rust.yml` gained a `wasm` job: clippy for the target, a build, an
+  execution assertion, the WebAssembly integration tests, the shell caller's
+  test, and the `.wasm` uploaded as an artefact.
+
+### Changed
+
+- Bash line coverage went from 59% to **98.14%**. Roughly half of that came
+  from fixing the measurement rather than adding tests: untraceable lines sat
+  in the denominator, 540 of 706 test files discarded their traces through
+  `2>&1`, silent timeout kills were counted as passes, and the sweep's `PS4`
+  truncated at 100 characters so the figure depended on how long your checkout
+  path was. Correcting those alone moved it 59.36% to 72.29% with no new test
+  written. Both Go modules are at 100%, where fuzzing found four defects.
+- The terminal palette now takes more than one colour from the wallpaper.
+  `term.bg` had two distinct values across all 228 themes; it now has 36, and
+  the status bar carries a secondary and tertiary alongside the accent. The
+  background is *tinted* rather than replaced — lightness is unchanged, so the
+  low-eye-strain surface the engine was built around is preserved, and
+  `DOTFILES_TERM_TINT=0` restores the flat neutrals.
+- Rust is no longer managed by mise. Its plugin exports `RUSTUP_TOOLCHAIN`,
+  which silently overrides `rust-toolchain.toml` in every project — a
+  repository pinned to 1.98.0 was being built with 1.97.1, and a local "all
+  green" said nothing about CI. rustup governs instead, so each project's own
+  pin is honoured.
+- `~/.cargo/config.toml` no longer sets a global `target-dir`. Cargo takes an
+  exclusive lock on it, so every repository sharing one path serialised: a
+  build in one project blocked `cargo test` in another, and cargo prints
+  nothing while it waits, so it read as a hang. sccache recovers the shared
+  dependency cache without the lock.
+- mise's tool directories are promoted above Homebrew and the shims on `PATH`,
+  fused into the existing dedup pass rather than added as a second walk.
+
+### Fixed
+
+- AI provider dispatch now uses the installed CLIs' prompt modes; OpenCode
+  installs through its native mise backend. Noninteractive status checks no
+  longer open terminal pickers. Reviewed upstream installer checksums are refreshed.
+- Ollama prompts and interactive chat default to `qwen3.5:4b`; set
+  `DOTFILES_OLLAMA_MODEL` to select another downloaded model.
+- Neovim configures the current Treesitter and mason-lspconfig APIs, preserves
+  custom debugger configurations, and uses Mason's Python debug adapter.
+- Health checks recognize named SSH key pairs and the configured age identity;
+  doctor includes Codex and reports absent optional AI providers as information.
+- Homebrew's rustup is available in the shared shell and Fish paths. Go uses
+  its system temporary directory instead of a potentially missing custom directory.
+- Terminal test fixtures explicitly control `NO_COLOR`.
+
+- `dot doctor`, `dot health`, `dot fleet`, the scorecard and the drift dashboard
+  no longer report permanent drift on macOS. The iCloud symlink hook is a
+  `run_before_` script that chezmoi lists as pending on every apply by design,
+  which made plain `chezmoi verify` exit 1 and every `chezmoi status` line
+  count read 1 on a fully synchronised machine. Those callers now pass
+  `--exclude=always`; files, directories, symlinks and `run_once`/`run_onchange`
+  scripts still count as drift.
+- markdown-preview.nvim no longer blocks `dot upgrade`'s plugin sync. Its build
+  step ran `cd app && npm install`, which rewrote the upstream `app/yarn.lock`
+  on every build and left the checkout dirty, so Lazy refused to update it.
+  The spec now uses upstream's `mkdp#util#install`, which downloads the
+  prebuilt preview server and leaves the checkout untouched.
+
+- Replaced the destructive mechanism behind the macOS iCloud symlink hook. The
+  previous implementation could remove real content from `~/Documents` and
+  `~/Desktop`; the replacement only ever removes an empty directory, refuses to
+  act on a non-empty one, and leaves an existing correct symlink untouched.
+- Reported what it declined to do, and why, instead of failing silently.
+- The health-probe record no longer claims `"engine": "wasm"` when it was
+  produced by a host binary. `ENGINE` is now `cfg`-selected, so the field
+  states where the bytes were actually computed: `wasm` from the module,
+  `native` from the host build. This is what makes the field evidence rather
+  than a label, and both halves are asserted in CI.
+- Corrected the documentation that described `lib/wasm-tools` as vendored
+  third-party tooling or as "not actually WebAssembly": `docs/ECOSYSTEM.md`,
+  `docs/architecture/REPO_LAYOUT.md`, `docs/STRUCTURE.md`,
+  `docs/ARCHITECTURE.md`, `docs/reference/TOOLS.md` and `REUSE.toml`.
+- `workbench.colorTheme` had been commented out on every machine this was
+  ever applied to. A template newline was chomped, welding the setting onto
+  the comment above it. Two thirds of the theme labels also named themes no
+  extension registers — "Tokyonight Mocha" and "Everforest Latte", where
+  Mocha and Latte are Catppuccin flavours rather than a general dark/light
+  suffix. The editor is now pinned to Catppuccin, and the icon theme ids are
+  the ones the extension actually declares.
+- Twelve documented defects, each with a regression test proven to fail
+  against the unfixed code first: `dot theme set` aborting before its picker,
+  `dot fleet namespace set` reporting success while writing nothing,
+  `dot agent delegate` requiring a GNU `timeout` absent from stock macOS, a
+  registry cache keyed by path so changing the URL served a stale index for
+  six hours, and `dot doctor --audit` routing to a script not in the tree.
+  Two of the reported findings turned out to be wrong, and correcting them
+  was more useful than fixing them.
+- `chezmoi apply` no longer silently discards edits made directly in `$HOME`.
+  Local drift is captured into the source instead of overwritten.
+- macOS home folders (`~/Desktop`, `~/Documents`, `~/Public` and the rest) are
+  excluded from chezmoi management entirely, as a second layer beneath the
+  iCloud hook's own refusals.
+- `docs-coverage.sh` and `traceability-coverage.sh` stopped masking their own
+  exit codes, so a failing gate now fails.
+- `dot benchmark` is routed. Every layer but the router already had it.
+- `dot upgrade` no longer hangs on a question nobody can see. Each phase's
+  output is captured to a log, so when `chezmoi update` met a locally edited
+  managed file it asked "has changed since chezmoi last wrote it?" on the
+  terminal's tty while the run looked merely slow. The step runner now closes
+  stdin and passes `--no-tty`, so the prompt fails fast, the step is marked
+  failed, and the surfaced tail names the fix (`chezmoi apply` to choose per
+  file, or `chezmoi update --force`).
+- `dot upgrade`'s Neovim phase actually syncs plugins. `nvim -l` does not
+  load `init.lua`, so `scripts/nvim/headless-upgrade.lua` never found
+  lazy.nvim and logged "skipping plugin update" on every run. The phase now
+  passes `-u` with the user's `init.lua` (honouring `XDG_CONFIG_HOME` and
+  `NVIM_APPNAME`) ahead of `-l`, and reports a visible skip when there is no
+  config to load.
+- `dot doctor` no longer warns about a missing `cargo-install-update` on a
+  machine that has no `cargo` for it to run through; the check now reports
+  "not needed" there and keeps warning where a Rust toolchain is present.
+
+## v0.2.519 — 2026-08-13
+
+### Added
+
+- Implemented the Model Context Protocol server the discovery card has always
+  advertised. `dot mcp serve` now speaks JSON-RPC 2.0 over newline-delimited
+  frames on stdin/stdout: `initialize`, `initialized`, `ping`, `tools/list`,
+  `tools/call`, `resources/list`, `resources/read`,
+  `resources/templates/list`, `logging/setLevel`, and a clean shutdown on EOF.
+  It is a third Go module, `defaults/dot_local/share/dot-mcp`, deployed to
+  `~/.local/bin/dot-mcp`.
+- Served four read-only tools — `mcp-doctor`, `agent-mode`,
+  `workstation-attestation` and `fleet-status` — each a fixed `dot` argument
+  vector run without a shell, and five read-only resources covering the MCP
+  policy, the MCP registry, the agent profiles and both discovery cards.
+  Mutating paths are deliberately not exposed.
+
+### Changed
+
+- Corrected `.well-known/mcp/server-card.json` to describe the server that now
+  exists: the stdio transport is `dot mcp serve` rather than the one-shot
+  `dot mcp --strict --json` audit, and the declared tools, resources and
+  capabilities are pinned to the running registry by tests that fail in both
+  directions. `entrypoints.mcp` in the A2A card was updated to match.
+
+### Fixed
+
+- Rendered the Nerd Font check as a chezmoi template so its verified-download
+  dependency is resolved before an apply begins. This avoids an unreliable
+  nested `chezmoi source-path` call while chezmoi is executing the hook.
+- Added a real-apply regression test for the font hook's source resolution.
+
 ## v0.2.518 — 2026-08-13
 
 ### Changed
@@ -288,9 +477,11 @@ headers across the source tree.
   to `batcat`/`fdfind`; a missing apt/dnf/pacman warns loudly instead of silently
   installing nothing; WSL gets a best-effort `wslu` install for `wslview`. fish
   and nushell now export `EDITOR`/`VISUAL`/`PAGER` to match the zsh/bash profile.
+<!-- REUSE-IgnoreStart -->
 - **Licensing:** added `SPDX-License-Identifier: MIT` headers (SPDX-first / REUSE
   form) and normalized the copyright line to `Sebastien Rousseau` across 831
   repo-only source files; dropped the contradictory `All rights reserved.`.
+<!-- REUSE-IgnoreEnd -->
 - **README** — fixed the OpenSSF Best Practices badge (was linking to the
   new-project form with a static label; now the live `cii/percentage/12840`
   endpoint linked to the real project).